CVE-2025-13428

A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution RCE in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containi...

EUVD-2025-201914

Malicious code in do-not-install-this-package-001 PyPI...

EUVD-2025-201907

Malicious code in telcoo PyPI...

Malicious code in telcoo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c96937a82adce2ecc6628245fd858587131511b4145c04f577ec25d8fa846577 Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce...

EUVD-2025-201908

Malicious code in graphsync PyPI...

EUVD-2025-201887

Malicious code in raft-dask PyPI...

CVE-2025-13428

CVE-2025-13428 affects the SecOps SOAR server. The vulnerability arises from weak validation of uploaded Python package code in custom integrations, allowing an authenticated user with an IDE role to achieve Remote Code Execution (RCE) via a malicious setup.py during installation. Impact is serve...

CVE-2025-13428 RCE in SecOps SOAR server via user-provided Python packages

A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution RCE in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containi...

Malicious code in sketchfab-spinner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f004e2139080a087917f5cfc654423a3ed60ca232dd8a051955d6af9508b1a8f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2025-201857

Malicious code in sketchfab-spinner PyPI...

MAL-2025-192380 Malicious code in sketchfab-spinner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f004e2139080a087917f5cfc654423a3ed60ca232dd8a051955d6af9508b1a8f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Google SecOps SOAR Server 安全漏洞

Google SecOps SOAR Server is a security platform from Google, Inc USA. A security vulnerability exists in Google SecOps SOAR Server that stems from insufficient code validation of uploaded Python packages, which could lead to remote code execution...

PT-2025-49804

A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution RCE in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containi...

MAL-2025-192379 Malicious code in helloharry123p (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6e199ebf30ba4e39d4e6bd9fc4d31ffa9f0a7687e21f67e2e6e8c01e3f24717a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2025-201711

Malicious code in graphnode PyPI...

EUVD-2025-201612

Malicious code in hexdeci PyPI...

Malicious code in python-tg-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5397ab6595b8237172e9a49952d092803e03526e3dda8277c64dc4d26ae45ff2 During importing, a dependency with infostealer is loaded and package attempts to exfiltrate credentials. --- Category: MALICIOUS - The campaign has clearly...

EUVD-2025-201590

Malicious code in python-tg-bot PyPI...

EUVD-2025-201589

Malicious code in blank-lib PyPI...

Malicious code in blank-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96f1bcd77950a6cd42af11d0d4fb4ba3d58349cfde6236027341c044e152bfeb This is an infostealer, based on Blank Grabber. It's used as dependency in other malicious packages --- Category: MALICIOUS - The campaign has clearly maliciou...